hero777 Privacy Policy

1.1 The data controller for all personal data processed through the hero777 platform is hero777, operating the online casino and sports betting platform accessible at hero777.bio. The Platform operates within the PAGCOR regulatory framework applicable to licensed gambling activities in the Philippines.

1.2 hero777 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. The DPO may be contacted at the address provided in Section 14 of this Policy.

1.3 Where hero777 engages third-party service providers who process personal data on behalf of the Platform (data processors), such processors are contractually required to handle that data only in accordance with hero777's instructions and applicable data protection law. hero777 remains the data controller in all such arrangements.

2.1 hero777 collects the following categories of personal data in connection with the registration, operation, and management of Player accounts:

2.2 hero777 does not intentionally collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act of 2012 (including race, ethnic origin, marital status, health information, or religious beliefs) unless such information is voluntarily disclosed by a Player in the context of a support interaction or responsible gaming enquiry, in which case it is processed solely for the purpose for which it was disclosed.

3.1 hero777 collects personal data through the following channels and mechanisms:

• Direct provision by you: When you register an account, complete KYC verification, make deposits or withdrawal requests, contact customer support, participate in promotions, or update your account settings;
• Automated technical collection: When you access and use the hero777 platform, technical data including IP address, device information, browser data, and session activity is automatically collected through standard server logging and analytics technologies;
• Cookies and similar technologies: hero777 uses cookies and similar tracking technologies as described in Section 8 of this Policy;
• Third-party verification services: During KYC processing, identity verification data may be supplemented by information obtained from third-party identity verification service providers and publicly available government records;
• Payment processors: Transaction reference data is received from GCash, Maya, BPI, BDO, and other payment processors to confirm deposit and withdrawal status;
• Anti-fraud and AML systems: Risk profiling and anti-money laundering screening may involve cross-referencing data against commercially available fraud prevention databases and regulatory watchlists.

4.1 hero777 processes personal data only for specific, legitimate purposes. The primary purposes for which personal data is processed, and the legal basis for each, are as follows:

• Account registration and management — Necessary for the performance of the contract between hero777 and the Player (RA 10173, Sec. 12(b));
• Identity verification (KYC) — Compliance with PAGCOR licensing requirements and obligations under the Anti-Money Laundering Act of the Philippines (legal obligation basis — RA 10173, Sec. 12(c));
• Payment processing — Performance of contract; necessary to process deposits and withdrawals requested by the Player;
• Anti-money laundering (AML) and fraud prevention — Compliance with the Philippines Anti-Money Laundering Act (AMLA) and legitimate interests of hero777 in preventing financial crime;
• Responsible gaming compliance — Legal obligation under PAGCOR regulations; hero777's legitimate interest in preventing harm to vulnerable Players;
• Customer support — Performance of contract; legitimate interests of hero777 in resolving disputes and improving service quality;
• Platform analytics and improvement — Legitimate interests of hero777 in understanding how the Platform is used and improving its features;
• Direct marketing — Consent of the Player (which may be withdrawn at any time — see Section 12);
• Legal proceedings and regulatory compliance — Compliance with legal obligations; protection of the legal rights of hero777 and its Players.

4.2 hero777 will not use personal data for purposes incompatible with those stated in this Policy without first obtaining the Player's explicit consent or establishing an alternative lawful basis for the new processing purpose.

5.1 hero777 shares personal data with the following categories of third parties, strictly as required for the operation of the Platform:

• Payment processors: GCash (G-Xchange Inc.), Maya (Voyager Innovations Inc.), BPI, BDO, Metrobank, and other payment providers receive transaction data necessary to process deposits and withdrawals;
• KYC and identity verification providers: Third-party identity verification services receive identity documents and photographs to perform automated and manual identity checks as required by PAGCOR;
• Game providers: Game providers (including JILI Gaming, Pragmatic Play, Evolution Gaming, and others) receive game session data necessary to operate their games within the hero777 lobby;
• Fraud prevention and AML screening services: Risk assessment providers receive transaction and identity data to screen against fraud and money laundering watchlists;
• Cloud hosting and infrastructure providers: Server hosting providers process data on hero777's behalf in the course of providing secure hosting infrastructure;
• Customer support tools: Live chat and ticketing platform providers process support interaction data;
• Regulatory authorities: PAGCOR and other Philippine regulatory and law enforcement authorities may receive personal data where hero777 is legally required to disclose it, including in the context of gaming audits, AML investigations, or court orders.

5.2 All third-party data processors engaged by hero777 are contractually required to maintain appropriate technical and organisational security measures, process data only on hero777's instructions, and comply with applicable data protection law including the Philippines Data Privacy Act of 2012.

6.1 Some of the third-party service providers engaged by hero777 operate outside the Philippines. Where personal data is transferred to a country outside the Philippines, hero777 ensures that appropriate safeguards are in place to protect the data in accordance with the Data Privacy Act of 2012 and NPC regulations on cross-border data transfers.

6.2 Safeguards for international data transfers employed by hero777 include: contractual data processing agreements incorporating NPC-approved standard clauses; transfers to jurisdictions that the NPC has recognised as providing an adequate level of personal data protection; and, where applicable, obtaining the Player's explicit consent to the transfer.

6.3 Players who wish to obtain information about the specific safeguards in place for a particular international data transfer may contact hero777 at [email protected] with the subject line "International Transfer Enquiry".

7.1 hero777 retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

7.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to a specific individual. Anonymised data may be retained for statistical and analytical purposes without time limit.

7.3 Where a legal claim has been or is reasonably anticipated to be made, hero777 may retain relevant personal data beyond the standard retention periods until the claim is resolved.

8.1 hero777 uses cookies and similar tracking technologies on the Platform to ensure its proper functioning, remember player preferences, analyse usage patterns, and support anti-fraud measures. By continuing to use the hero777 platform after being informed of cookie use, you consent to the use of cookies as described in this section.

8.2 The following categories of cookies are used on hero777:

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session authentication cookies that maintain your logged-in status, security cookies that prevent cross-site request forgery (CSRF) attacks, and load-balancing cookies. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings and whether you have acknowledged notifications. Disabling these may affect your experience on the Platform.
• Analytics cookies: Collect anonymous data about how Players use the Platform, including pages visited and features used, to help hero777 improve its services. This data does not personally identify individual Players.
• Security and fraud prevention cookies: Assist in detecting and preventing fraudulent activity, multiple account creation, and bot access attempts.

8.3 hero777 does not use third-party advertising or targeting cookies. No data collected through hero777's cookies is shared with advertising networks.

8.4 You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent the Platform from functioning correctly and will require you to log in on each visit.

9.1 hero777 implements appropriate technical and organisational security measures to protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS 1.3 / SSL 256-bit encryption for all data in transit between the Player's browser and hero777 servers;
• Encryption at rest for sensitive personal data stored on hero777 servers;
• Multi-factor authentication (MFA) for all hero777 administrative access to systems containing personal data;
• Role-based access controls ensuring that personal data is accessible only to staff members whose role requires it;
• Regular security vulnerability scanning and penetration testing of Platform infrastructure;
• Automated intrusion detection and monitoring systems;
• Formal data breach detection, reporting, and response procedures aligned with NPC notification requirements.

9.2 Notwithstanding the security measures hero777 maintains, no internet-based platform can guarantee absolute security. Players are encouraged to use strong unique passwords for their hero777 accounts and to enable two-factor authentication (2FA). Players are responsible for maintaining the confidentiality of their own account credentials.

9.3 In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected Players, hero777 will notify the National Privacy Commission (NPC) and affected Players within 72 hours of becoming aware of the breach, in accordance with NPC Circular 16-03 and related issuances.

10.1 hero777 enforces mandatory KYC age verification for all registered accounts prior to the first withdrawal. Age verification includes submission of a valid Philippine government-issued photo identification document confirming date of birth. Accounts where age cannot be confirmed are restricted from financial transactions pending completion of verification.

11.1 To exercise any of the data subject rights described in this Policy, Players should submit a written request to hero777 via email at [email protected] with the subject line "Data Privacy Request — [Right Being Exercised]" (e.g., "Data Privacy Request — Right to Access").

11.2 Requests must include sufficient information to verify the identity of the requesting Player, including: full name, registered email address or mobile number, and, where appropriate, a copy of the government ID used during KYC registration. This identity verification requirement protects against unauthorised access to Player data by third parties.

11.3 hero777 will acknowledge receipt of a data subject request within 5 business days and will respond substantively within 15 business days of receipt. Where a request is particularly complex or involves multiple rights, hero777 may extend this period by a further 15 business days, in which case the requesting Player will be notified of the extension and the reason for it.

11.4 Data subject rights requests are fulfilled at no charge. Where requests are manifestly unfounded, excessive, or repetitive, hero777 reserves the right to charge a reasonable administrative fee or decline to respond, subject to applicable NPC guidance.

11.5 Where hero777 declines to fulfil all or part of a data subject request, the Player will be informed of the reason for the refusal and of their right to lodge a complaint with the NPC. Complaints to the NPC may be submitted through the NPC's official complaint process.

12.1 hero777 may send promotional communications to Players who have consented to receive marketing messages during registration or at a subsequent point. Marketing communications may be sent via email or SMS to the registered contact details on the Player's account.

12.2 Consent to receive marketing communications is entirely voluntary and separate from acceptance of the Terms and Conditions. Declining marketing communications does not affect your ability to use the hero777 platform or access promotions — promotional offers remain accessible within the Platform's promotions section regardless of marketing preference settings.

12.3 Players may withdraw consent to receive marketing communications at any time by:

• Updating marketing preferences in the Account Settings section of the hero777 platform;
• Clicking the unsubscribe link included in any hero777 marketing email; or
• Contacting hero777 support at [email protected] with the subject "Marketing Opt-Out".

12.4 Withdrawal of marketing consent will be processed within 5 business days. System-generated transactional communications (including deposit confirmations, withdrawal notifications, account security alerts, and KYC status updates) are not marketing communications and cannot be unsubscribed from as they are essential to the operation of your account.

13.1 hero777 reserves the right to amend, update, or replace this Privacy Policy at any time. Changes may be made to reflect updates to applicable law or regulation, changes to hero777's data processing practices, new services or features added to the Platform, or clarification of existing provisions.

13.2 Where changes to this Policy are material — meaning they significantly affect the ways in which hero777 processes personal data or the rights of Players — hero777 will notify registered Players via email or in-platform notification at least 14 days before the changes take effect, where practicable. For non-material amendments, the updated Policy will take effect upon publication on the hero777 website.

13.3 The effective date of the current version of this Policy is always displayed at the top of this page. Players are encouraged to review this Policy periodically. Continued use of the hero777 platform following publication of an updated Privacy Policy constitutes acceptance of the revised Policy.

14.1 For any queries, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by hero777, please contact us at:

14.2 If you are not satisfied with hero777's response to a data privacy concern, you have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines. The NPC is the supervisory authority responsible for enforcing the Data Privacy Act of 2012 in the Philippines.

14.3 This Privacy Policy was last updated on January 1, 2026 and supersedes all prior versions. The current version is accessible at hero777.bio/privacy-policy.